Systems and methods for protecting notification messages

Patent metadata

Field	Value
Publication number	US-9735965-B1
Application number	US-201514687941-A
Country	US
Kind code	B1
Filing date	Apr 16, 2015
Priority date	Apr 16, 2015
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

The disclosed computer-implemented method for protecting notification messages may include (1) identifying at least a portion of a notification message to be protected from modification, (2) using a hash function to calculate a hash of the portion of the notification message, (3) encrypting the hash, (4) adding the encrypted hash to the notification message, and (5) transmitting the notification message to a client that is configured to verify that the portion of the message has not been modified by (a) decrypting the encrypted hash, (b) using the hash function to recalculate the hash of the portion of the notification message, and (c) verifying that the decrypted hash is the same as the recalculated hash. Various other methods, systems, and computer-readable media are also disclosed. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for protecting notification messages, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying at least a portion of a notification message that is to be:
protected from modification; and
transmitted to a client via an unsecured network connection;

using a hash function to calculate a hash of the portion of the notification message;
encrypting the hash;
adding the encrypted hash to a header of the notification message;
delimiting the portion of the notification message by:
inserting, within a body of the notification message, predetermined sequences of at least one character at a beginning and an end of the portion of the notification message; and
inserting, within the header of the notification message, a protected block identifier that identifies the predetermined sequences inserted into the body of the notification message; and

transmitting the notification message to the client via the unsecured network connection, where the client verifies that the portion of the notification message has not been modified by:
decrypting the encrypted hash;
identifying the portion of the notification message based on the protected block identifier and the predetermined sequences inserted into the notification message;
using the hash function to recalculate the hash of the portion of the notification message; and
verifying that the decrypted hash is the same as the recalculated hash.

2. The computer-implemented method of claim 1 , wherein encrypting the hash comprises encrypting the hash using a private signing key such that the encrypted hash is capable of being decrypted using a public verification key.

3. The computer-implemented method of claim 2 , wherein the public verification key comprises a public key in a digital certificate.

4. The computer-implemented method of claim 1 , wherein adding the encrypted hash to the header of the notification message comprises adding the encrypted hash to a predetermined field within the header of the notification message.

5. The computer-implemented method of claim 4 , wherein:
the portion of the notification message comprises all of the notification message, including the header of the notification message; and
the computer-implemented method further comprises:
adding an additional header to the notification message; and
indicating in the additional header that the portion of the notification message protected from modification comprises all of the notification message.

6. The computer-implemented method of claim 1 , wherein the predetermined sequences inserted at the beginning and the end of the portion of the notification message comprise HyperText Markup Language (HTML) tags.

7. The computer-implemented method of claim 1 , wherein transmitting the notification message is performed by a server that transmits the notification message via the unsecured network connection after establishing the unsecured network connection in response to a long-polling request made by the client.

8. The method of claim 1 , wherein identifying the portion of the notification message that is to be protected from modification comprises identifying a critical portion of the notification message that contains information relevant to the performance of the client.

9. The method of claim 8 , wherein the critical portion of the notification message indicates at least one of:
an available software update for the client; and
configuration information about software running on the client.

10. A system for protecting notification messages, the system comprising:
an identification module, stored in memory, that identifies at least a portion of a notification message that is to be:
protected from modification; and
transmitted to a client via an unsecured network connection;

a hashing module, stored in memory, that uses a hash function to calculate a hash of the portion of the notification message;
an encryption module, stored in memory, that encrypts the hash;
a messaging module, stored in memory, that:
adds the encrypted hash to a header of the notification message; and
delimits the portion of the notification message by:
inserting, within a body of the notification message, predetermined sequences of at least one character at a beginning and an end of the portion of the notification message; and
inserting, within the header of the notification message, a protected block identifier that identifies the predetermined sequences inserted into the body of the notification message;

a communication module, stored in memory, that transmits the notification message to the client via the unsecured network connection, where the client verifies that the portion of the notification message has not been modified by:
decrypting the encrypted hash;
identifying the portion of the notification message based on the protected block identifier and the predetermined sequences inserted into the notification message;
using the hash function to recalculate the hash of the portion of the notification message; and
verifying that the decrypted hash is the same as the recalculated hash; and

at least one physical processor configured to execute the identification module, the hashing module, the encryption module, the messaging module, and the communication module.

11. The system of claim 10 , wherein the encryption module encrypts the hash by encrypting the hash using a private signing key such that the encrypted hash is capable of being decrypted using a public verification key.

12. The system of claim 11 , wherein the public verification key comprises a public key in a digital certificate.

13. The system of claim 10 , wherein the messaging module adds the encrypted hash to the header of the notification message by adding the encrypted hash to a predetermined field within the header of the notification message.

14. The system of claim 13 , wherein:
the portion of the notification message comprises all of the notification message, including the header of the notification message;
the messaging module adds an additional header to the notification message; and
the messaging module indicates in the additional header that the portion of the notification message protected from modification comprises all of the notification message.

15. The system of claim 10 , wherein the predetermined sequences inserted at the beginning and the end of the portion of the notification message comprise HTML tags.

16. The system of claim 10 , wherein transmitting the notification message is performed by a server that transmits the notification message via the unsecured network connection after establishing the unsecured network connection in response to a long-polling request made by the client.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify at least a portion of a notification message that is to be:
protected from modification; and
transmitted to a client via an unsecured network connection;

use a hash function to calculate a hash of the portion of the notification message;
encrypt the hash;
add the encrypted hash to a header of the notification message;
delimit the portion of the notification message by:
inserting, within a body of the notification message, predetermined sequences of at least one character at a beginning and an end of the portion of the notificati

Assignees

• Symantec Corp

Inventors

• Shavell Michael

Classifications

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title